{"id":"16e13731-0452-4e38-9ca5-80e7063691e3","engagementId":"590dab8e-8aaf-422b-8b49-b9ed7d3e8a03","data":{"brief":{"id":"a4487870-0b6c-4a72-87f9-5ab07d01e30b","name":"WestJet's Vulnerability Disclosure Program","tagline":"WestJet VDP","description":"\u003cp\u003eThis program is intended as a responsible vulnerability disclosure program for WestJet. If you have found a security issue in a WestJet owned property, please use the submit button in the upper right hand area to submit your report. We appreciate your effort in making WestJet more secure, and thank you for your report! Good luck and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003ePlease note that in some cases, a vulnerability found and raised against one target may also be applicable to another target due to the nature of our environment configuration. As such, remediation may be applied across our environment and a reward will be paid to the first finding only. Our recommendation is that you submit one report outlining the impact across multiple targets in order to demonstrate impact and receive the most timely response possible from our team\u003c/p\u003e","industryTagId":null,"targetsOverview":"\u003ch3\u003eSubmissions:\u003c/h3\u003e\n\n\u003cp\u003e\u003cstrong\u003ePlease note:\u003c/strong\u003e If you find a vulnerability against one target, it may be applicable to another target due to the nature of the WestJet environment's configuration. If you do find the same vulnerability on multiple targets, please consolidate them into a single submission and do not break them out into multiple submissions. As such, remediation may be applied across the WestJet environments and a reward will only be paid for the first finding. \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eAccess/Credentials:\u003c/h3\u003e\n\n\u003cp\u003ePlease sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://researcherdocs.bugcrowd.com/v2.0/docs/your-bugcrowdninja-email-address\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch3\u003eOut-of-Scope\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe passenger rights claims functionality: \u003cstrong\u003ehttps://www.westjet.com/en-ca/travel-info/flight-interruptions-passenger-rights/claims\u003c/strong\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eCross Origin Resource Sharing (CORS) \u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDO NOT exfiltrate any live client data - ONLY test against accounts you expressly own\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDO NOT perform any testing that might degrade the user experience on the app - if you have questions, please ask and err on the side of caution\u003c/p\u003e\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDO NOT perform any automated testing against forms or functionalities that go out to support teams or any other group that will have to process your payload\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":false,"additionalInformation":""},"scope":[{"id":"ce7367b4-60f4-44e8-a80b-23a67f552bcf","name":"WestJet VDP Pro In-Scope Group","targets":[{"id":"28a00cff-bbd8-4ef7-9599-55d2e5d48a7b","uri":"https://www.westjet.com","name":"www.westjet.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f01ed63b-f296-4393-889f-62794babc426","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"28a00cff-bbd8-4ef7-9599-55d2e5d48a7b"},{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"28a00cff-bbd8-4ef7-9599-55d2e5d48a7b"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"28a00cff-bbd8-4ef7-9599-55d2e5d48a7b"},{"id":"9558d6b3-9880-4506-9e19-55dc1d7d8aff","name":"RequireJS","targetId":"28a00cff-bbd8-4ef7-9599-55d2e5d48a7b"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"28a00cff-bbd8-4ef7-9599-55d2e5d48a7b"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"28a00cff-bbd8-4ef7-9599-55d2e5d48a7b"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"28a00cff-bbd8-4ef7-9599-55d2e5d48a7b"}],"recentChangeFlags":null},{"id":"0802f868-43b5-4878-89fd-6e5e9754b619","uri":"https://www.flyswoop.com","name":"www.flyswoop.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ff65a00f-22b2-43e5-bae9-3ef9acd786eb","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"0802f868-43b5-4878-89fd-6e5e9754b619"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0802f868-43b5-4878-89fd-6e5e9754b619"},{"id":"ef82adfb-fd5b-439b-a090-ed44823bf259","name":"Azure","targetId":"0802f868-43b5-4878-89fd-6e5e9754b619"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"bb87b100-1e3e-459a-9cfe-89c0a6fd7ba4","name":"Out of scope","targets":[{"id":"f038251e-c927-4c90-a67a-7c8c85151e66","uri":null,"name":"travel.westjet.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"62c40a8d-0eb5-449b-a2df-6b6271a91e4d","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"f038251e-c927-4c90-a67a-7c8c85151e66"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"f038251e-c927-4c90-a67a-7c8c85151e66"}],"recentChangeFlags":null},{"id":"7d4680c6-28d6-4b38-b352-ab3a7ac5709d","uri":null,"name":"biz.westjet.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c6688fc2-f48c-4381-a714-6a34b80ccedc","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7d4680c6-28d6-4b38-b352-ab3a7ac5709d"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"590dab8e-8aaf-422b-8b49-b9ed7d3e8a03","code":"westjet-disclose","state":"in_progress","endsAt":null,"bountyId":"f4f26c0a-22f0-467c-81b4-4ca62830f778","startsAt":"2020-08-27T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":null,"methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/185e/5e28/0f07d884/34f839f112a968a855cb3c7aa3c3dd32_WestJet_Logo.jpeg","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":false,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2020-08-27T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/westjet-disclose","changelogs":"/engagements/westjet-disclose/changelog","submissions":null,"announcements":"/engagements/westjet-disclose/announcements","hallOfFame":"/engagements/westjet-disclose/hall_of_fames","crowdstream":null},"announcementsCount":0,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/westjet-disclose/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=westjet-disclose\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/westjet-disclose/engagement_subscribers","engagementChangelogsUrl":"/engagements/westjet-disclose/changelog","publishedAt":"2020-08-20T15:38:50.946Z","engagementChangelogUrl":"/engagements/westjet-disclose/changelog/16e13731-0452-4e38-9ca5-80e7063691e3","createUserFeedbacksUrl":"/engagements/westjet-disclose/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}